Vulnerability · Published Sep 29, 2026 · Assigned by Hitachi Energy
CVE-2026-8067
Medium 6.5
In plain English
A medium-severity missing authorization in RTU500 series CMU firmware from Hitachi Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 86.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | RTU500 series CMU firmware | 9.0 – before 12.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H